Does cyber insurance cover quantum-computing attacks?

Start with the loss, then examine the technology

Imagine a company discovers that confidential documents were accessed without authorization. The practical insurance questions concern what happened, which organization suffered which costs, and when those facts became known. A future quantum technique could be one part of that story. It does not remove the need to establish the policy’s coverage trigger.

NIST’s migration work addresses the threat powerful quantum computers could pose to vulnerable public-key cryptography. That technical concern is a reason to prepare; it is not evidence that a particular claim has happened or that an insurer must pay it.

Use a real form as a reading exercise

Travelers publishes a US CyberRisk specimen, CYB-16001 Rev. 06-20. It uses different triggers for liability and first-party protections and states that only insuring agreements with limits shown in the declarations apply. This illustrates why the word “cyber” on a quote is insufficient to establish the scope of protection.

The specimen is an educational example, not a statement about a current quotation, every state, or another insurer. Obtain the proposed declarations, base wording, and every endorsement together. A later endorsement may change language you found in a sample online.

Ask about information stolen now and read later

Consider a hypothetical sequence: encrypted information is copied in one year, its contents become readable much later, and the organization then receives a demand. Ask the broker how the contract distinguishes occurrence, discovery, a claim first made, and notice to the insurer. Also ask which known circumstances, prior acts, or related-event provisions require attention.

Do not assign this scenario to a policy year yourself. Preserve the timeline and have qualified insurance and legal advisers assess the complete facts. An extended reporting provision is not an automatic answer to every delayed-discovery problem.

Review the boundaries explicitly

Our recommended discussion list includes the following questions. They identify issues for review rather than predict how any insurer would decide a claim.

• Which definition would apply to unauthorized decryption, and what evidence would establish it?
• Would a critical provider’s outage qualify, and are the relevant providers within the policy definition?
• Could war, infrastructure, systemic-event, sanctions, or other exclusions affect the scenario?
• What reporting deadlines, approved-provider arrangements, retention, sublimits, and consent requirements apply?

Separate preparation costs from incident costs

Create separate budget lines for planned cryptographic migration and potential incident response. Ask whether any proposed policy includes relevant prevention services or conditional post-incident improvements. Do not assume ordinary software replacement, consulting, or a complete migration project will be reimbursed.

NYDFS’s 2021 framework encourages clarity about cyber exposure and the management of systemic and silent cyber risk. It addresses New York-authorized property/casualty insurers; it does not create universal quantum coverage for businesses.

A useful next step

Write a one-page scenario describing the data, affected systems, provider dependencies, confidentiality period, and potential operational interruption. Share it through the broker’s approved secure channel, along with your current policy. Ask for a written explanation that cites the relevant clauses and identifies remaining uncertainty.

Meanwhile, continue security planning with your technical team. Insurance review and risk reduction support different needs. Neither requires predicting the exact year when a cryptographically relevant quantum computer will exist.